Admin sign‑in

Tip: set ADMIN_PASS in .env.